VYPR
← Fedoraproject

Vendor CVEs

Fedoraproject

All CVEs

833 total · sorted by risk
  • CVE-2015-4858Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913.

  • CVE-2015-4836Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP.

  • CVE-2015-4830Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

  • CVE-2015-4826Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types.

  • CVE-2015-4819Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.

  • CVE-2015-4815Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL.

  • CVE-2015-4807Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.03

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier, when running on Windows, allows remote authenticated users to affect availability via unknown vectors related to Server : Query Cache.

  • CVE-2015-4802Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.

  • CVE-2015-4792Oct 21, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802.

  • CVE-2015-5235Oct 9, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.03

    IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.

  • CVE-2015-5234Oct 9, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.02

    IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to…

  • CVE-2015-6938Sep 21, 2015
    Jupyter
    Notebook
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name. NOTE: this was originally reported…

  • CVE-2015-6665Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to…

  • CVE-2015-6524Aug 24, 2015
    Apache
    Activemq
    risk 0.00cvss —epss 0.08

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was…

  • CVE-2015-5166Aug 12, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.

  • CVE-2015-5154Aug 12, 2015
    QEMU
    Qemu
    risk 0.00cvss —epss 0.01

    Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

  • CVE-2015-2059Aug 12, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.03

    The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

  • CVE-2015-1840Jul 26, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server,…

  • CVE-2015-4454Jun 17, 2015
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php.

  • CVE-2015-4342Jun 17, 2015
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.

  • CVE-2015-2665Jun 17, 2015
    Cacti (software)
    Cacti
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-4106Jun 3, 2015
    QEMU
    Qemu
    risk 0.00cvss —epss 0.00

    QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact…

  • CVE-2015-2922May 27, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.03

    The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement…

  • CVE-2015-2666May 27, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges…

  • CVE-2015-3885May 19, 2015
    Dcraw Project
    Dcraw
    risk 0.00cvss —epss 0.05

    Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

  • CVE-2015-0278May 18, 2015
    Libuv Project
    Libuv
    risk 0.00cvss —epss 0.03

    libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

  • CVE-2015-3451May 12, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

  • CVE-2015-3340Apr 28, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

  • CVE-2015-0844Apr 14, 2015
    Wesnoth
    Battle For Wesnoth
    risk 0.00cvss —epss 0.02

    The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

  • CVE-2015-2782Apr 8, 2015
    Open-source ARJ archiver
    Open-source ARJ archiver
    risk 0.00cvss —epss 0.06

    Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.

  • CVE-2015-0557Apr 8, 2015
    Arj Software
    Arj Archiver
    risk 0.00cvss —epss 0.03

    Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

  • CVE-2015-0556Apr 8, 2015
    ARJ
    ARJ archiver
    risk 0.00cvss —epss 0.04

    Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive.

  • CVE-2015-2756Apr 1, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express…

  • CVE-2015-2752Apr 1, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

  • CVE-2015-2751Apr 1, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.02

    Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.

  • CVE-2015-1827Mar 30, 2015
    Freeipa
    Freeipa
    risk 0.00cvss —epss 0.03

    The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number…

  • CVE-2015-1609Mar 30, 2015
    MongoDB
    MongoDB
    risk 0.00cvss —epss 0.03

    MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.

  • CVE-2015-2157Mar 27, 2015
    Putty
    Putty
    risk 0.00cvss —epss 0.01

    The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.

  • CVE-2015-2317Mar 25, 2015
    Djangoproject
    Django
    risk 0.00cvss —epss 0.05

    The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as…

  • CVE-2015-2316Mar 25, 2015
    Djangoproject
    Django
    risk 0.00cvss —epss 0.05

    The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

  • CVE-2015-0252Mar 24, 2015
    Apache
    Xerces C\+\+
    risk 0.00cvss —epss 0.40

    internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

  • CVE-2015-2152Mar 18, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when…

  • CVE-2015-0778Mar 16, 2015
    Fedoraproject
    Fedora
    risk 0.00cvss —epss 0.04

    osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

  • CVE-2015-1782Mar 13, 2015
    Libssh2
    Libssh2
    risk 0.00cvss —epss 0.04

    The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.

  • CVE-2015-2151Mar 12, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.01

    The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via…

  • CVE-2015-2045Mar 12, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors.

  • CVE-2014-8112Mar 10, 2015
    Fedoraproject
    389 Directory Server
    risk 0.00cvss —epss 0.02

    389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed-pw-switch option is set to off, which allows remote authenticated users to obtain sensitive information by reading the Changelog.

  • CVE-2014-8105Mar 10, 2015
    Fedoraproject
    389 Directory Server
    risk 0.00cvss —epss 0.02

    389 Directory Server before 1.3.2.27 and 1.3.3.x before 1.3.3.9 does not properly restrict access to the "cn=changelog" LDAP sub-tree, which allows remote attackers to obtain sensitive information from the changelog via unspecified vectors.

  • CVE-2015-2206Mar 9, 2015
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.03

    libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for…

  • CVE-2015-1464Mar 9, 2015
    Bestpractical
    Request Tracker
    risk 0.00cvss —epss 0.02

    RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.

Page 12 of 17